Steve Riley on Security

Browse by Tags

Attacks against integrity: I’ve been mentioning this frequently during my talks in the last 12 months: that accidental or malicious data modification is yet something else we need to defend against. Richard Bejtlich wrote last year about attack progressions , and this year summarized Read More...
Posted 20 January 09 08:28 by Steve Riley | 3 Comments
Filed under security policies, protection, integrity
Updated Microsoft Security Assessment Tool: Greetings. In case you haven’t already read about it, we recently updated the Microsoft Security Assessment Tool (MSAT). Version 4.0 hit the web on 31 October. It’s been four years since the initial release, and two years since the prior version. Between Read More...
Posted 01 December 08 08:13 by Steve Riley | 6 Comments
Filed under security policies, risk mitigation, assessing security
Plan now to eliminate "power users" from your domains: I've seen some conversations lately about the Power Users group -- how powerful is it, really, and why did we remove the group from Windows Vista? That group had rights install software and drivers. And if you can install software and drivers, then you Read More...
Posted 11 February 08 10:03 by Steve Riley | 1 Comments
Filed under Windows Vista, authentication, security policies, access control
Who should do your security audits? Or, how do you organize the security department?: An interesting question came up today. The group responsible for configuring and maintaining the firewalls at a customer also believes that they should be the only ones to audit their configurations. Others in the security department are uneasy with this, Read More...
Posted 07 February 08 02:25 by Steve Riley | 2 Comments
Filed under security policies, risk mitigation, security science
What's your data worth? More importantly, to whom?: This week, I'm attending and spoke at a cybercrime conference in Singapore. One of the presenters made a very good point, and I want to share it with you. When considering how to protect your data, don't consider how valuable it might be to an attacker. Read More...
Posted 24 October 07 11:49 by Steve Riley | 6 Comments
Filed under security policies, risk mitigation, protection, security science
More on the necessity of antivirus software: A few days ago, I wrote a brief post about my non-use of antivirus software on my own computers. A number of people have asked me privately if I am recommending such a stance to other individuals or to organizations. Let me be perfectly clear: absolutely Read More...
Posted 25 September 07 10:53 by Steve Riley | 14 Comments
Filed under security policies, risk mitigation, protection, malware
Antivirus software -- who needs it?: In the newsgroups a few weeks ago, someone asked about which anti-virus software is best for experts. This is a really curious question. I've been involved in computer security -- as a practitioner, a consultant, and an instructor/speaker -- for several Read More...
Posted 22 September 07 09:14 by Steve Riley | 22 Comments
Filed under security policies, risk mitigation, protection, malware
Password policies. Once again.: Recently in the newsgroups ( news:microsoft.public.security , to be specific) the question of password polices and the out-of-box defaults came up. The poster lamented a number of things: that Microsoft doesn't enable account lockout by default, that Read More...
Posted 04 September 07 03:14 by Steve Riley | 21 Comments
Filed under authentication, security policies, passwords
When you say goodbye to an employee: ...what do you do with his or her account? Recently this question came up -- someone was asking for guidance on how to handle this very situation. And, as often happens, the question was more about process and policy than anything to do with the technical Read More...
Posted 31 May 07 11:29 by Steve Riley | 6 Comments
Filed under security policies, threats, encryption
Enabling Secure Anywhere Access in a Connected World: A few times each year, Bill Gates or Steve Ballmer publish an executive memo. The first memo was Bill's essay on trustworthy computing , in July 2002. Today Bill has a new memo , one that is very important for all of us who strive to achieve a balance Read More...
Posted 06 February 07 12:47 by Steve Riley | 1 Comments
Filed under access technologies, security policies, protection, networking
Why administrative passwords will never be like nuclear missile launchers: During the past few months many people have lamented that Windows lacks a nuclear missile style control option for administrator passwords. Surely you've read about or seen photographs of missile silos where two operators, separated by a distance greater Read More...
Posted 21 November 06 02:16 by Steve Riley | 11 Comments
Filed under authentication, security policies, risk mitigation, passwords, security science, Active Directory, physical security
Did you know that you ALREADY have an e-mail policy?: An email access policy can be expressed in one of two ways: E-mail is mission critical to our business. Therefore, we permit employees to read and compose e-mail from any location in the world where employees can access the Internet, using either company-issued Read More...
Posted 10 September 06 05:34 by Steve Riley | 7 Comments
Filed under email, access technologies, security policies, risk mitigation, protection
Configure your router to block DOS attempts: Some time ago I had a discussion with a friend. He disagreed with my recommendations on how to configure a border router and the firewall behind it. I claimed that in the border router between you and your ISP, configure the six rules to block most denial Read More...
Posted 10 July 06 01:27 by Steve Riley | 13 Comments
Filed under access technologies, security policies, risk mitigation, threats, protection, configuration
Security myths and passwords: I like this a lot. http://www.cerias.purdue.edu/weblogs/spaf/general/post-30/ In the practice of security we have accumulated a number of “rules of thumb” that many people accept without careful consideration. Some of these get included in policies, and Read More...
Posted 30 April 06 09:07 by Steve Riley | 3 Comments
Filed under identity, authentication, security policies, passwords, security myths
What do YOU need out of two-factor authentication?: Two-factor authentication continues to grow in popularity and emerge as a security requirement for many people I meet with. At Microsoft, we use smartcards internally for VPN access right now; soon we'll be requiring smartcards for domain logon, too. Read More...
Posted 20 April 06 03:37 by Steve Riley | 43 Comments
Filed under identity, authentication, biometrics, email, access technologies, security policies, risk mitigation, passwords

Steve Riley on Security

Browse by Tags

Search

This Blog

Resources for you

Tags

Archives

Syndication